Havuz

Open-source guardrails for AI agents powered by decision models like Jev; checks prompts, retrieved content, tool calls and responses for pr

Static security review for AI agent configs (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input tha

Open-source config scanner for AI coding agents: scores the permissions, hooks, sandbox and MCP settings of Claude Code, Codex, Cursor and G

Streaming privacy for LLM apps: pii-leak-benchmark (does your gateway leak PII in streams?), chunk-invariance (one-line test for split-bound

Convert public bug bounty hackerone reports (9,950) into reusable AI security skills and vulnerability knowledge.

Open-source, self-hosted AI agent for terminal, Telegram and Raspberry Pi. Local Ollama or Claude/Codex workers, enforced by a deterministic

CI-native agent CLI tool for deterministic pipeline gating.

AI 应用合规网关 · 一行命令体检 AI 项目的「数据出境 / 硬编码密钥 / 个人信息暴露」（网安法·PIPL·等保2.0·数据出境·AI标识），并给出境内模型替代建议；可作运行时防护拦截注入与数据外泄 · 中文优先 · 零依赖 · 开源

AI protocol scanner — discover exposed MCP servers, A2A Agent Cards, and open LLM APIs in one command. 一条命令盘点 MCP、A2A Agent Card 和 LLM 开放接口暴

The network layer for AI agents. Reach your customers' on-prem data, show what you build, keep it running — through one relay that your mac

Testing and observability for multi-agent delegation, MCP tools, permissions, sandboxed actions, prompts, and workflow replay.

Prompt-injection guardrail for LLM applications. Compact model that outperforms larger open-source guards. No regex, no signatures. Demo: an

Ready-to-run examples showing NoPII PII protection with OpenAI, Anthropic, LangChain, LlamaIndex, and more

🛡️ A modern, AI-powered WAF with visual forensic playback via rrweb. Protect your web apps with LLM-driven threat detection, real-time visua

🦞 Local, read-only security audit for your OpenClaw agent. Finds config, prompt-injection and supply-chain risks, watches for drift, and ve

Get Claude Code and other AI agents approved for use at work — deterministic guardrails on every tool call, tamper-evident audit logs, and a

pytest for AI agents - Autonomous red-teaming, behavioral monitoring & security testing for LLM agents

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

See how you really use AI — X-ray your AI coding sessions locally

Outside-in replication of Anthropic's Mythos Preview / Project Glasswing — open-source agentic vulnerability-discovery scaffold on Claude Op

250+ real-world TypeScript AI projects: workflows, agents, and multi-agent systems with production-ready architecture, not chatbot demos.

Luvv-MCP 是一个 AI 原生的前端安全分析引擎，接入 Claude Code 后，你说一句"帮我审计这个网站"，AI 就能自动完成技术栈识别（1.8 万条规则覆盖 CMS/框架/CDN/中间件）、泄露扫描（阿里云 AK、GitHub Token、Webhook、J

RAG pipeline security testing toolkit - 27 techniques across 6 kill chain phases, mapped to MITRE ATLAS

Trust nothing. Ship safely. — Skeptical-reading and prompt-injection defense skill for AI agents. Provenance tagging, red-flag patterns, ref

AI agent firewall that intercepts tool calls (file, shell, network) and enforces deterministic policies at sub-microsecond latency using CEL

Deterministic governance for AI coding agents. Cedar-based policy engine that intercepts every agent action and evaluates it against determi

agents that run on your claude subscription. multi-agent, sandboxed by default. polished telegram UI.

Tamper-evident evidence and verification layer for AI agents. Verify any agent's session offline with just openssl. No cloud, no lock-in.

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

Eversec AIGov-Insight Web

An OWASP-aligned intentionally vulnerable platform for learning and testing AI, LLM, RAG, MCP, and Agentic AI security.

Red-team your RAG pipeline for prompt injection, source-document leakage, and cross-document smuggling, in CI. The gap between RAG eval (RAG

Python SDK for LLM guardrails with safety classification, PII detection, prompt injection defense, and grounding checks. Protect AI applicat

Runtime security for AI agents. In-process, zero dependencies, Apache 2.0.

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

Autonomous, read-only endpoint investigation via MCP. Ask a question about your fleet, get a narrative answer with containment recommendatio

Governed Postgres access for AI assistants: an MCP gateway with OAuth 2.1 and OIDC login, one Postgres role per person, database-enforced re

Screens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a clien

A Claude / AI security review prompt for shipping safe apps. TRAP (True Readiness Audit Prompt) turns Claude Code, Cursor, or Copilot into a

Open-source AI security platform providing perimeter defense for LLMs and AI agents through swarm analysis, policy enforcement, adversarial

Security scanner for AI agent skills. Flags known prompt-injection, data-exfiltration and malicious-payload patterns before you install

Python SDK for accurate and verifiable agent tool use. Agents verify that answers came from the right source and were not changed. Downstrea

Empowers the AI to perform penetration testing, vulnerability assessment, reconnaissance, and security reporting — all through natural langu

An autonomous agentic pipeline that finds, proves, and patches real C memory-safety vulnerabilities end-to-end using a single 7B open-source

Keep your sensitive credentials out of the agents you build and the coding agent you use. Test any agent with planted fake keys, or see whic

Free security skills for AI-built apps — run /lictor-security-check in Claude Code before you ship. Plain English, read-only, no telemetry.

Default-deny MCP/JSON-RPC security gateway for agent tool-call authorization, prompt-injection detection, exfiltration controls, and audit t

BloodHound-style risk analysis for multi-agent AI architectures. Parses CrewAI, Dify, LangGraph, or generic YAML into a typed capability gra

An open-source AppSec agent that reasons like an analyst: real scanners, your org's context, and a conversation instead of 400 findings.